Starting at 13:16 UTC on September 8, a series of packages pushed to npm appeared to contain malicious code. The attack is highly targeted — a large-scale campaign aimed primarily at Web3 users.
Please pay attention to this incident and protect yourselves. I can’t offer a fix.
The malicious code hijacks browser wallets (such as MetaMask) and network requests (fetch and XMLHttpRequest), intercepting cryptocurrency transactions in ETH, BTC, SOL, TRX and more, and redirects funds to the attacker’s wallets (such as 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976) by swapping the destination address.
A major supply chain attack
The NPM account of the well-known developer qix was compromised, and malicious versions of dozens of packages were published — including chalk, strip-ansi and color-convert.
How the attack works
The code first checks whether window.ethereum exists (injected by wallet extensions like MetaMask). If so, it proceeds with a passive address-swapping attack.
Passive address swapping
The malicious script contains Bitcoin (BTC), Ethereum (ETH), Solana (SOL), Tron (TRX), Litecoin (LTC) and Bitcoin Cash (BCH) wallet addresses owned by the attacker. The code uses a sophisticated technique called the Levenshtein distance algorithm, which measures the visual similarity between two strings — it picks the address from the list that looks most like the target.
It then replaces the address displayed in the browser page. When the user copies the address, they’re actually copying the attacker’s wallet address.
Active transaction hijacking
If a wallet is detected, the malware fires off its most dangerous component.
When the user initiates a transaction, the malware intercepts the data before it’s sent to the wallet for signing. It then modifies the transaction in memory, replacing the recipient’s address with the attacker’s wallet address.
Tracking the stolen funds
Because the blockchain is transparent, we can monitor these fraudulent addresses. Here is one of the main Ethereum addresses used in this attack. You can watch its activity live on Etherscan.
One of the attacker’s Ethereum addresses: 0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976
See this GitHub Gist for a list of all the wallets: https://gist.github.com/jdstaerk/f845fbc1babad2b2c5af93916dd7e9fb
Wrap-up
This attack targets code maintainers, which poisons the entire codebase and ends up affecting every user. As ordinary users, there seems to be little we can do about it.
Protecting yourself
Although some of the affected versions have been pulled from npm, others are still available.
Double-check the wallet address on every single transaction.
Before a large transfer, send a small amount first, verify the address carefully again, and only then send the rest.